Cyber Incident Victim: Everett & Hurite Ophthalmic Association
Date:
Feb 2020
Location:
United States of America
Summary
Everett & Hurite Ophthalmic Association experienced unauthorized access to an employee email account over a one-month period, discovered during an investigation prompted by unusual activity. The organization secured the account and engaged forensic specialists, determining that patient data was present in the compromised email but finding no evidence of actual information viewing or misuse. Exposed information primarily included patient names from an internal CMS report, though some individuals' data extended to dates of birth, financial and health insurance details, Social Security numbers, and medical treatment information. The incident affected 34,113 individuals and was reported to federal health authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 23, 2020, Everett & Hurite Ophthalmic Association (EHOA) detected unusual activity in an employee email account, prompting immediate action to secure the account through password changes. The organization initiated an investigation with third-party forensic specialists to determine the scope and nature of the incident. Forensic analysis revealed unauthorized access to the single email account between February 25, 2020, and March 25, 2020. While investigators could not confirm whether specific information within the account was viewed by unauthorized parties, EHOA conducted a comprehensive review of the email contents to identify potentially exposed data. The review confirmed the presence of protected health information and personal data within the account during the intrusion period. EHOA maintained throughout its notification that it had not identified any evidence of actual or attempted misuse of the compromised information as of June 8, 2020.
The compromised email account contained patient information primarily consisting of first and last names from an internal report created for Centers for Medicaid and Medicare Service (CMS) reporting purposes. For certain individuals, additional sensitive data was present, including dates of birth, financial information, health insurance details, Social Security numbers, medical records, and treatment information. EHOA reported the incident to the U.S. Department of Health and Human Services (HHS), disclosing that 34,113 patients were affected by the breach. The organization did not publicly specify whether it implemented additional security measures beyond password resets or whether law enforcement was notified. No operational disruptions or system compromises beyond the single email account were described in EHOA’s public statement.